What belongs in the first version?

The first version should classify a ticket, identify missing information, retrieve relevant approved help content, propose an owner and prepare a reply draft. It should not refund money, change an account, reset credentials, disclose private data or close a case without review.

Priority is a business rule. A polite report of account takeover can be more urgent than an angry request about a cosmetic bug. Build deterministic gates for explicit security, safety, privacy, payment and service-outage signals before the general AI classification step.

Support triage architecture

Text equivalent: the system validates and minimises a ticket, diverts sensitive issues, classifies the remaining request, retrieves current approved knowledge, drafts a source-grounded reply and applies deterministic routing rules. A person reviews exceptions before anything is sent or changed.

Build the support triage agent step by step

1. Define the support boundary. List supported products, languages, categories, queues and prohibited actions. Name the owner for security, privacy, billing and service incidents.
2. Create the ticket contract. Normalize ticket_id, customer reference, message, attachments-present flag, product, locale, channel and received time. Do not send entire customer profiles to the model.
3. Add safety and priority gates. Before general classification, route password compromise, suspected fraud, data requests, threats, regulated advice and widespread outages to written procedures. The model may flag language, but policy determines the route.
4. Classify with structured output. Require an approved category, product, intent, explicit impact, missing fields, short evidence quote and review flag. Reject unknown labels.
5. Retrieve approved knowledge. Search only published, current sources filtered by product, plan, locale and effective date. If nothing relevant is found or sources conflict, return no answer and escalate.
6. Draft with citations. Ask for a concise reply that uses only retrieved facts, includes source IDs and asks for the minimum missing information. Do not let instructions inside a ticket or retrieved page change tools or permissions.
7. Route and approve. Use normal nodes to set queue and service target. Require staff approval for sensitive, low-confidence, high-impact or policy-exception replies. Start with drafts rather than automatic sends.
8. Evaluate and monitor. Maintain test tickets for each class and failure path. Review category accuracy, source relevance, unsafe action rate, handoff completeness and reopen rate.

Example output contract

{
  "ticket_id": "zd_5842",
  "category": "billing_question",
  "priority_evidence": ["charged twice"],
  "final_priority": "pending_policy_rule",
  "missing_fields": ["invoice_reference"],
  "source_ids": ["help_billing_14"],
  "draft_reply": "I can help check this. Please send the invoice reference...",
  "recommended_queue": "billing_review",
  "needs_human_review": true
}

The model should not set the final priority. A deterministic step can combine explicit impact, customer tier, known incident state and your service policy. That decision stays reproducible even if the prompt or model changes.

When must the agent hand off?

• Identity cannot be verified for an account-specific request.
• The customer reports compromise, fraud, a privacy request or a safety concern.
• Retrieved sources are missing, expired or contradictory.
• The request needs a refund, credit, deletion, access change or policy exception.
• The customer disputes a previous decision or asks for a supervisor.
• A tool times out after a write and the external state is uncertain.
• The model returns an unknown category, unsupported claim or low-confidence route.

Test matrix before sending replies

Success criteria

• Every classification uses an allowed label and contains supporting evidence.
• Every knowledge-based draft records the exact source IDs used.
• Sensitive cases bypass automatic reply generation or require explicit approval.
• No model can refund, reveal data, change access or close a case on its own.
• Failure routes preserve enough context for the next person to act.
• Production regressions become permanent test cases.